Often, when a Password Recovery is performed, the user has to perform a Password Change again after the Password Recovery as defined for Password MUST Change.
and modifies their password to a new value.